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DETAILED ACTION 



Claim Status 



1. 



Claims 1, 3-7, and 9-13 have been amended. 



2. 



Claims 1, 3-7, and 9-13 have been examined. 



Claim Rejections - 35 USC § 101 



3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

4. Claims 1 and 3-6 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 



MPEP2106: 

The claims lack the necessary physical articles or objects to constitute a machine or a 
manufacture within the meaning of 35 U.S.C. 101 . They are clearly not a series of steps or acts 
to be a process nor are they a combination of chemical compounds to be a composition of matter. 
As such, they fail to fall within a statutory category. They are, at best functional descriptive 
material per se. 

Descriptive material can be characterized as either "functional descriptive material" or 
"nonfunctional descriptive material". Both types of "descriptive material" are nonstatutory when 
claimed as descriptive material per se, 33 F.3d at 1360, 31 USPQ2d at 1759. When functional 
descriptive material is recorded on some computer-readable medium, it becomes structurally and 
functionally interrelated to the medium and will be statutory in most cases since use of 
technology permits the function of the descriptive material to be realized. Compare In re Lowry, 
32 F.3d 1579, 1583-84, 32 USPQ2d 1031, 1035 (Fed. Cir. 1994) 

Merely claiming nonfunctional descriptive material, i.e. abstract ideas, stored on a 
computer-readable medium, in a computer, or on an electromagnetic carrier signal, does not 
make it statutory. See Diehr, 450 U.S. at 185-86, 209 USPQ at 8 (noting that the claims for an 
algorithm in Benson were unpatentable as abstract ideas because "[t]he sole practical application 
of the algorithm was in connection with the programming of a general purpose computer" 
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Claim 1 recites "a computer system". However, claim 1 fails to contain any computer 
hardware that is used to implement the system so as to realize its functionality. Thus, the body 
of claim 1 is merely an abstract idea and is being processed without any links to a practical result 
in the technology arts and without any computer hardware manipulation. Contrary to arguments 
made by some Applicants, use of the word "computer system" does not inherently mean that the 
claim is directed to a machine. Only if at least one of the claimed elements of the system is a 
physical part of a device can the system as claimed constitute part of a device or a combination 
of devices to be a machine within the meaning of 101 . Claims 3-6 fail to resolve the deficiencies 
of claim 1 and are therefore rejected. 



5. Claim 13 is rejected under 35 U.S. C. 101 because the claimed invention is directed to 
non-statutory subject matter. 



MPEP 2106: 

The claims lack the necessary physical articles or objects to constitute a machine or a 
manufacture within the meaning of 35 U.S. C. 101 . They are clearly not a series of steps or acts 
to be a process nor are they a combination of chemical compounds to be a composition of matter. 
As such, they fail to fall within a statutory category. They are, at best functional descriptive 
material per se. 

Descriptive material can be characterized as either "functional descriptive material" or 
"nonfunctional descriptive material". Both types of "descriptive material" are nonstatutory when 
claimed as descriptive material per se, 33 F.3d at 1360, 31 USPQ2d at 1759. When functional 
descriptive material is recorded on some computer-readable medium, it becomes structurally and 
functionally interrelated to the medium and will be statutory in most cases since use of 
technology permits the function of the descriptive material to be realized. Compare In re Lowry, 
32 F.3d 1579, 1583-84, 32 USPQ2d 1031, 1035 (Fed. Cir. 1994) 

Merely claiming nonfunctional descriptive material, i.e. abstract ideas, stored on a 
computer-readable medium, in a computer, or on an electromagnetic carrier signal, does not 
make it statutory. See Diehr, 450 U.S. at 185-86, 209 USPQ at 8 (noting that the claims for an 
algorithm in Benson were unpatentable as abstract ideas because "[t]he sole practical application 
of the algorithm was in connection with the programming of a general purpose computer" 
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Claim 13 recites "a computer system". However, claim 1 fails to contain any computer 
hardware that is used to implement the system so as to realize its functionality. Thus, the body 
of claim 13 is merely an abstract idea and is being processed without any links to a practical 
result in the technology arts and without any computer hardware manipulation. Contrary to 
arguments made by some Applicants, use of the word "computer system" does not inherently 
mean that the claim is directed to a machine. Only if at least one of the claimed elements of the 
system is a physical part of a device can the system as claimed constitute part of a device or a 
combination of devices to be a machine within the meaning of 101 . 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 

7. Claims 1, 3-7, 9-13 are rejected under 35 U.S.C. 103(a) as being unpatentable over US 
Patent Application Publication Number 2004/0088570 issued to Guy William Welch Roberts et 
al (hereafter Roberts) in view of US Patent 6721721 by Bates et. al. (hereafter Bates). 

Claim 1: 

Roberts discloses the following claimed limitations: 
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"a) means for generating data with regard to the file to characterize its identity and for thereby 
referencing a computer database to determine whether it is an instance of a known file" [0033 
lines 8-12, removing the internet address from the currently held data (e.g. stripping the internet 
address from the e-mail or the data file and possibly replacing it with a marker indicating that it 
has been removed because it pointed to malware.). 0034, store data identifying malware free 
content that may be accessed over the internet. This may take the form of a database storing 
internet addresses that have been pre-emptively scanned for malware content in accordance with 
the previous steps and found not to contain malware (together with page version identifying data 
such as date, filesize, checksum, etc). Accordingly, means for generating data (marker) with 
regard to the file (data) to characterize its identity (pointed to malware) and for thereby 
referencing a computer database (database) to determine whether it is an instance of a known file 
(identifying malware free content)] 

"b) means for selectively subjecting the file to a number of heuristic procedures to determine 
whether or not it contains, or is likely to contain, malware" [0037-0038, and Figure 6, elements 
42-48. Accordingly, b) means for selectively subjecting the file to a number of heuristic 
procedures (figure 6 elements 42-48) to determine whether or not it contains, or is likely to 
contain, malware (figure 6 element 46)] 

"c) means for determining, in dependence upon the record, if any, of the file in the database, 
whether the file can be regarded as safe in dependence on factors"[0034, lines 1-7, store data 
identifying malware free content that may be accessed over the internet. This may take the form 
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of a database storing internet addresses that have been pre-emptively scanned for malware 
content in accordance with the previous steps and found not to contain malware (together with 
page version identifying data such as date, filesize, checksum, etc), figure 6. Accordingly, c) 
means for determining (figure 6), in dependence upon the record (database), if any, of the file in 
the database (database storing internet addresses that have been pre-emptively scanned), whether 
the file can be regarded as safe (identifying malware free content, figure 6 step 50) in 
dependence on factors (date, filesize, checksum)] 

"and for controlling the means b) such that the file, if the file is to be regarded as safe, is either 
subject to less thorough processing than if it were not so regarded or not subject to processing by 
the means b) at all" [0034, lines 1-7, store data identifying malware free content that may be 
accessed over the internet. This may take the form of a database storing internet addresses that 
have been pre-emptively scanned for malware content in accordance with the previous steps and 
found not to contain malware (together with page version identifying data such as date, filesize, 
checksum, etc). 0037 lines 12-16, if the checksums match then the webpage may be assumed to 
not have been changed in the intervening period and not require rescanning for malware prior to 
being returned to the requester. Accordingly, and for controlling the means b) such that the file 
(data/webpage/content), if the file is to be regarded as safe (malware free content), is either 
subject to less thorough processing than if it were not so regarded or not subject to processing by 
the means b) at all (not require rescanning) is disclosed ]. 
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Roberts does not explicitly teach factors including the "length of time which the database 
indicates that the file has been known without malware-containing instances of it being 
detected." 

On the other hand, Bates discloses if the URL was not found to be untrustworthy, control 
passes to block 98 to determine whether a "good" url threshold time has past-that is, whether an 
excessive period of time has elapsed since the URL was last virus checked. Figure 3 elements 
96-99Accordingly, the length of time (threshold time) which the database indicates that the file 
has been known without malware containing instances (virus) of it being detected (virus in the 
past). 

Both Roberts and Bates are directed to the same field of endeavor as applicant's 
invention. Both are directed to improving virus scanning systems. It would have been obvious 
to a person of ordinary skill in the art at the time the invention was made to have applied the 
disclosure of Bates above to the disclosure of Roberts for the purpose of reducing the time of 
scanning for a virus, and to ensure that virus status information for URL's in the virus database is 
kept relatively current (Bates, col. 14 lines 1-5). 



Claims 3 and 9: 

As per claims 3 and similarly claim 9, the combination of Roberts and Bates disclose in Roberts: 
"wherein the means c) performs said determining of whether a file can be regarded as safe in 
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dependence on factors including sources, recorded in the database, from which instances of the 
file have originated"[paragraph 34, lines 1-6, Internet address] 

Claims 4 and 10: 

As per claims 4 and similarly claim 10, the combination of Roberts and Bates disclose in 
Roberts: "performs said determining of whether a file can be regarded as safe in dependence on 
factors including the number of times, recorded in the database, instances of the file have been 
processed" [paragraph 37, lines 8-18, checksum comparison and a mechanism which uses dates 
and other information to determine currency and status] 

Claims 5 and 11: 

As per claims 5 and similarly claim 1 1, the combination of Roberts and Bates disclose in 
Roberts: "means for updating the database in dependence upon the result of the processing of the 
file by the means b)" [paragraph 33, virus found actions include updating] 

Claims 6 and 12: 

As per claims 5 and similarly claim 11, the combination of Roberts and Bates disclose in 
Roberts: "wherein the updating of the database, is operative in the event of the means b) 
determining that the file contains, or is likely to contain, malware to delete the record of the file 
in the database or to update the record of the file in the database so that the file no longer is taken 
be safe" [paragraph 33, virus found actions]. 
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Claim 7: 

As per claim 7, similar as claim 1 above and Roberts further teaches storing the determination of 
whether or not the file contains, or is likely to contain malware [0034, lines 1-7, store data 
identifying malware free content that may be accessed over the internet. This may take the form 
of a database storing internet addresses that have been pre-emptively scanned for malware 
content in accordance with the previous steps and found not to contain malware (together with 
page version identifying data such as date, filesize, checksum, etc.) Accordingly, disclosing 
storing the determination of whether or not the file contains or is likely to contain malware (store 
data identifying malware free content)] 

Claim 13 

As per claim 13 Roberts discloses the following claimed limitations: 

"an engine that generates data with regard to the file to characterize its identity and for thereby 
referencing a computer database to determine whether it is an instance of a known file" [0033 
lines 8-12, removing the internet address from the currently held data (e.g. stripping the internet 
address from the e-mail or the data file and possibly replacing it with a marker indicating that it 
has been removed because it pointed to malware.). 0034, store data identifying malware free 
content that may be accessed over the internet. This may take the form of a database storing 
internet addresses that have been pre-emptively scanned for malware content in accordance with 
the previous steps and found not to contain malware (together with page version identifying data 
such as date, filesize, checksum, etc). Accordingly, an engine (step 30) that generates data 
(marker) with regard to the file (data) to characterize its identity (pointed to malware) and for 
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thereby referencing a computer database (database) to determine whether it is an instance of a 
known file (identifying malware free content)] 



"that processes the file by selectively subjecting the file to a number of heuristic procedures to 
determine whether or not it contains, or is likely to contain, malware" [0037-0038, and Figure 6, 
elements 42-48. Accordingly, that processes the file by selectively subjecting the file to a 
number of heuristic procedures (figure 6 elements 42-48) to determine whether or not it contains, 
or is likely to contain, malware (figure 6 element 46)] 

"and that determines, in dependence upon the record, if any, of the file in the database, whether 
the file can be regarded as safe in dependence on factors including the length of time for which 
the database indicates that the file has been known without malware- containing instances 
of it being detected" [0034, lines 1-7, store data identifying malware free content that may be 
accessed over the internet. This may take the form of a database storing internet addresses that 
have been pre-emptively scanned for malware content in accordance with the previous steps and 
found not to contain malware (together with page version identifying data such as date, filesize, 
checksum, etc), figure 6. Accordingly, and that determines, in dependence upon the record 
(database), if any, of the file in the database (database storing internet addresses that have been 
pre-emptively scanned. 0034, lines 8-10, data referred to by the internet addresses may also be 
stored), whether the file can be regarded as safe (identifying malware free content, figure 6 step 
50) in dependence on factors (date, filesize, checksum)] 
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"and for controlling the processing to which the file is subjected such that the file, if the file is to 
be regarded as safe, is either subject to less thorough processing than if it were not so regarded or 
not subject to the processing at all" [0034, lines 1-7, store data identifying malware free content 
that may be accessed over the internet. This may take the form of a database storing internet 
addresses that have been pre-emptively scanned for malware content in accordance with the 
previous steps and found not to contain malware (together with page version identifying data 
such as date, filesize, checksum, etc). 0037 lines 12-16, if the checksums match then the 
webpage may be assumed to not have been changed in the intervening period and not reuire 
rescanning for malware prior to being returned to the requester. Accordingly, and for controlling 
the processing to which the file is subjected such that the file (data/webpagc/content), if the file 
is to be regarded as safe (malware free content), is either subject to less thorough processing than 
if it were not so regarded or not subject to processing at all (not require rescanning) is disclosed 
]• 

Roberts does not explicitly disclose dependence on factors including the "length of time for 
which the database indicates that the file has been known without malware-containing instances 
of it being detected" 

On the other hand, Bates discloses if the URL was not found to be untrustworthy, control 
passes to block 98 to determine whether a "good" url threshold time has past-that is, whether an 
excessive period of time has elapsed since the URL was last virus checked. Figure 3 elements 
96-99. Accordingly, the length of time (threshold time) which the database indicates that the file 
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has been known without malware containing instances (virus) of it being detected (virus in the 
past). 

Both Roberts and Bates are directed to the same field of endeavor as applicant's 
invention. Both are directed to improving virus scanning systems. It would have been obvious 
to a person of ordinary skill in the art at the time the invention was made to have applied the 
disclosure of Bates above to the disclosure of Roberts for the purpose of reducing the time of 
scanning for a virus, and to ensure that virus status information for URL's in the virus database is 
kept relatively current (Bates, col. 14 lines 1-5). 

Response to Arguments 

8. Applicant's arguments with respect to claims 1, 3-7, and 9-13 have been considered but 
are moot in view of the new ground(s) of rejection. 

Applicant's mainly asserted "in dependence on factors including the length of time for 
which the database indicates that the file has been known without malware-containing instances 
of it being detected" is not disclosed by Miyata. 

In response, this is now moot. Bates discloses if the URL was not found to be 
untrustworthy, control passes to block 98 to determine whether a "good" url threshold time has 
past-that is, whether an excessive period of time has elapsed since the URL was last virus 
checked. Figure 3 elements 96-99. Accordingly, the length of time (threshold time) which the 
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database indicates that the file has been known without malware containing instances (virus) of it 
being detected (virus in the past). 



Conclusion 

9. The prior art made of record listed on pto-892 and not relied, if any, upon is considered 
pertinent to applicant's disclosure. 

10. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 



Contact Information 
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1 1 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MICHAEL PHAM whose telephone number is (571)272-3924. 
The examiner can normally be reached on 9am-5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Cottingham can be reached on 571-272-7079. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/M. P./ /John R. Cottingham/ 

Examiner, Art Unit 2167 Supervisory Patent Examiner, Art Unit 

2167 



